Skip to content
OpenAdvisories
Medium WID-SEC-2026-1665 12 CVEs

Devolutions Server: Mehrere Schwachstellen

Published May 25, 2026 · Updated May 25, 2026 · de-DE

Vendor: Devolutions Product: Server Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.

Product

Devolutions Server ist eine selbstgehostete, zentralisierte Plattform zur Verwaltung und Freigabe von Passwörtern, Verbindungsdaten und Zugriffen in IT-Teams

Vulnerabilities 12

  • High 7.6
    CVE-2026-9047

    Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allow…

    Devolutions Server
  • High 7.1
    CVE-2026-7325

    Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authentic…

    Devolutions Server
  • Medium 5.4
    CVE-2026-9251

    Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authentic…

    Devolutions Server
  • Medium 5.0
    CVE-2026-9245

    Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated …

    Devolutions Server
  • Medium 4.3
    CVE-2026-5171

    Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with acces…

    Devolutions Server
  • Medium 4.3
    CVE-2026-9223

    Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privilege…

    Devolutions Server
  • Medium 4.3
    CVE-2026-9224

    Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory…

    Devolutions Server
  • Medium 4.3
    CVE-2026-9246

    Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticate…

    Devolutions Server
  • Low 3.1
    CVE-2026-9249

    Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the p…

    Devolutions Server
  • Low 2.7
    CVE-2026-8477

    Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server a…

    Devolutions Server
  • Low 2.6
    CVE-2026-9248

    Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write acc…

    Devolutions Server
  • Low 2.4
    CVE-2026-9247

    Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permiss…

    Devolutions Server

Revision history

  1. #1

    Initiale Fassung

References